Attachment 15689 Details for Bug 12497 – first draft security advisory

[patch] first draft security advisory

CVE-2019-14902-sd-repl-advisory-01.txt (text/plain), 2.21 KB, created by Andrew Bartlett on 2019-12-16 04:47:45 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andrew Bartlett

Created: 2019-12-16 04:47:45 UTC

Size: 2.21 KB

patch

obsolete

>===========================================================
>== Subject:     Replication of ACLs set to inherit down a
>==              subtree on AD Directory not automatic
>==
>== CVE ID#:     CVE-2019-14902 
>==
>== Versions:    Samba 4.0 and later
>==
>== Summary:     The implementation of ACL inheritance in the
>==              Samba AD DC was not complete, and so absent a
>==              'full-sync' replication, ACLs could get out of
>==              sync between domain controllers.
>===========================================================
>
>===========
>Description
>===========
>
>A newly delegated right, but more importantly the removal of a
>delegated right, would not be inherited on any DC other than the one
>where the change was made. 
>
>==================
>Patch Availability
>==================
>
>Patches addressing both these issues have been posted to:
>
>    https://www.samba.org/samba/security/
>
>Additionally, Samba $VERSIONS have been issued
>as security releases to correct the defect.  Samba administrators are
>advised to upgrade to these releases or apply the patch as soon
>as possible.
>
>==================
>CVSSv3 calculation
>==================
>
>CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (5.4)
>
>==========
>Workaround
>==========
>
>Use of 'samba-tool drs replicate $DC1 $DC2 $NC --full-sync' will cause all ACLs to be syncronised from DC2 to DC1, for the given NC (naming context), eg:
>
>samba-tool drs replicate my-DC1 my-DC2 DC=samba,DC=example,DC=com --full-sync 
>samba-tool drs replicate my-DC1 my-DC2 CN=Configuration,DC=samba,DC=example,DC=com --full-sync 
>
>samba-tool drs replicate my-DC2 my-DC1 DC=samba,DC=example,DC=com --full-sync 
>samba-tool drs replicate my-DC2 my-DC1 CN=Configuration,DC=samba,DC=example,DC=com --full-sync
>
>=======
>Credits
>=======
>
>Reported by a number of Samba users and sites since 2017, but now
>recognised as a security issue after triage.  We apologise for the
>delay in dealing with this issue.
>
>Patches provided by Andrew Bartlett of the Samba Team and Catalyst.
>
>Advisory written by Andrew Bartlett of the Samba Team and Catalyst
>
>==========================================================
>== Our Code, Our Bugs, Our Responsibility.
>== The Samba Team
>==========================================================
>

Flags:

gary: review+

Actions: View

Attachments on bug 12497: 15633 | 15670 | 15678 | 15679 | 15680 | 15681 | 15685 | 15686 | 15687 | 15688 | 15689 | 15706 | 15708 | 15738